All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
Your smart TV knows what you’re watching. It can track content from your cable box, gaming console, antenna, and even videos you mirror from your phone. But most smart TVs let you turn that tracking off. However, a new study suggests that on Samsung and Vizio sets, that switch may not do what it promises.[1]
And on VIDAA OS, researchers found a publicly accessible server containing more than 57 million viewing-detection records linked to over one million TVs, revealing what content was being watched and when.
The risk? TV makers can use your viewing habits to target you with ads, while sharing or selling that data to other companies. In some cases, unencrypted tracking data can also expose what you watch, your device ID, and potentially sensitive interests.
Here's everything you need to know about this latest reveal and how you can stop your TV from spying on you.
Researchers from Northeastern University tested whether turning off “content recognition” on smart TVs stops them from sending reports on what you're watching.
On LG, Sony, Amazon Fire TV, and VIDAA, turning off automatic content recognition (ACR) works. However, on Samsung (Tizen) and Vizio, the TVs kept sending traffic consistent with tracking even after ACR was turned off.
ACR takes a small fingerprint of what's on your screen, which might be an audio snippet or a sample of the picture, and sends it to a company server. The server matches it against a library of shows and ads, the same way Shazam identifies a song. This results in a record of what you watched, and companies use it for audience measurement and targeted ads.
ACR is built into the TV's operating system, so it can monitor content from almost any source, be it an antenna, cable box, or gaming console plugged in via HDMI, a built-in streaming app, or even your phone's screen when you're mirroring it to your TV.
/images/2026/10/23/smart-tv-tracking-privacy-opt-out_01.jpg){kind=tracking}
The researchers tested 12 TVs from 10 brands, covering eight TV operating systems that run about 95% of U.S. smart TVs. They ran 5,943 automated experiments, repeating each test 30 times with ACR on and 30 times with ACR off.
However, one potential relief is that the traffic sent by Samsung and Vizio TVs, even after turning off ACR, is encrypted. This means researchers couldn’t confirm what data the TVs were actually sending. They described the traffic as suspicious and said it might indicate potential privacy violations.
But VIDAA's ACR traffic isn't encrypted at all. This means anyone positioned between the TV and the server, such as someone on the same network or an internet provider, could read it directly. This could reveal data such as permanent device IDs, app names and input sources, audio fingerprints, and, in some cases, actual show titles.
The ACR servers also sorted content into categories such as religion, politics, and health and medicine, and even tracked a children's app called VIDAA Kids. Moreover, VIDAA's ACR partner ran a server that required no login. In about three hours, researchers were able to collect 57 million viewing detections from more than one million TVs. After the researchers reported the flaw, the server was locked down to require a login, though VIDAA’s ACR data is still sent unencrypted.
On Vizio’s free streaming service, WatchFree+, the names of shows and channels you watch appear in readable internet lookups, so anyone on the network path could reconstruct a viewing history. Turning off ACR doesn’t stop it, and there’s no setting to disable it.
The researchers also found that five of the eight platforms don’t label their ACR settings adequately. While Samsung calls it “Viewing Information Services,” LG names it “Live Plus,” and Vizio calls it “Viewing Data.” The researchers described this as a dark pattern, a design choice that steers users away from making an informed choice. With ACR enabled, Netflix and YouTube weren’t tracked on any of the tested TVs.
ACR isn't a one-time login activity. It can keep a running record of what you watch, when you watch it, and for how long, across different inputs on your TV.
Over months and years, these records can reveal a lot about your personal life, such as your interests, daily routine, and even when you’re usually home. It could also expose things that you like to keep private, such as your religious beliefs, political leanings, or health conditions you're researching.
This is also not the first time Vizio has been found on the wrong side of customer data collection. In 2017, the company was ordered to pay $2.2 million to the FTC and the New Jersey Division of Consumer Affairs for installing software on about 11 million customers’ TVs to collect viewing data without their consent or knowledge. Vizio shared this data with third parties for audience measurement, ad effectiveness analysis, and targeted advertising.
Children aren't exempt either. ACR was found to be running on VIDAA Kids. U.S. law restricts the collection of data from children under 13, and a lawyer consulted by the researchers said this could raise concerns under existing laws.
Finally, unencrypted data doesn’t just reach the companies, as the VIDAA findings show. Anyone on your network or your internet service provider could potentially see what your household watches. If this information falls into the wrong hands, it could be used to target you with personalized phishing messages that imitate your TV company or streaming service provider.
If you want to avoid ACR, disconnect the TV from the network and use an external streaming device that doesn’t perform ACR.
Alternatively, you can turn off ACR on operating systems where it was proven to be effective in their tests, such as webOS, Fire TV OS, Sony Google TV, and VIDAA OS.
Researchers have also released a blocklist on GitHub for the remaining operating systems. You can use it to restrict these tracking servers without breaking normal viewing. However, this doesn’t stop the WatchFree+ leak.
While encryption prevented researchers from confirming exactly what data Samsung and Vizio TVs were sending, VIDAA’s unencrypted transmissions and Vizio’s WatchFree+ data leak exposed viewing information in ways that raised greater privacy concerns.
The study raises questions about whether smart TV privacy settings do what they promise. Smart TV makers don’t always make it clear what data their devices collect, where it goes, or whether opting out actually stops tracking.
If you're concerned about your TV tracking your viewing habits, you can disconnect it from the internet and use an external streaming device instead. You can also disable ACR on systems where the researchers found the opt-out effective or use their GitHub blocklist to restrict identified tracking endpoints.
Top-rated data removal service that scrubs your info from 420+ data broker sites automatically
Independently verified by Deloitte, meaning removals are actually sent, confirmed, and not just claimed
The Unlimited plan extends coverage to 2,000+ additional sites with human-assisted custom removals
/images/2023/07/07/best-identity-theft-protection-service.png)
/images/2023/10/12/best_identity_theft_protection_with_dark_web_monitoring.jpg)
/images/2026/10/23/smart-tv-tracking-privacy-opt-out.jpeg){kind=tracking}
/images/2026/10/23/hackers_changed_users_passwords_in_11.7m-account_capcom_breach.png)
/images/2026/10/22/closeup_of_the_signal_messaging_app_icon_on_a_smartphone_screen_displa_ESczEq4.jpg){kind=icon}
/images/2026/10/22/beware_these_phishing_tricks_after_historic_internet_meltdown.png)
/images/2026/10/20/google-search-redirects-privacy-security.jpeg)
/images/2026/10/20/trump-administration-voter-data-lawsuit.jpeg)
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2025/09/11/incogni-logo.png){kind=logo}
/authors/krishi_chowdhary_headshot.jpg)